# Per-Ticket Reproduction Policy

No prior successful runs found for this exact vulnerability.

## Patterns from Similar Vulnerabilities
- Clone the upstream repo into `/tmp` (or `$WORKDIR`) and enumerate tags/branches to locate the vulnerable version before checkout (e.g., `git tag --sort=-v:refname | head`).
- After checkout, use targeted `grep`/`sed` against source files to locate the vulnerable code paths or configuration constants.
- For JavaScript package issues, install the exact vulnerable version via `npm install <pkg>@<ver>` and inspect files under `node_modules/`.
- For C/C++ libraries, expect an autotools flow: install `autoconf/automake/libtool`, run `./autogen.sh`, then continue build steps.

## Approaches to Avoid
- Do NOT rely on absolute run-specific paths from past runs (use `$WORKDIR` instead).